Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have put together a portable apps USB stick for when I need to use random site computers, I also threw truecrypt on with an encrypted volume for some word documents.

The password I am using is much weaker than what is recommended (just a 4 digit number). The way I was thinking about it is this is still at least as secure as the windows xp laptop I cart around anyway, which has the same documents on it. My aim was to make it at least a little wrong for someone to access the documents, sort of like a padlock to keep out the honest criminals.

Is my logic flawed here?

share|improve this question
3  
The simple fact that you have a password makes your usb stick orders or magnitude more secure than not having a password at all. –  WalterJ89 Feb 27 '12 at 4:07
    
Hi @daniel, welcome to Information Security! It seems like you're implying that your laptop also has a 4 digit password? If that's not the case, why do you assume that that would be as secure as the laptop? And if it is - really? –  AviD Feb 27 '12 at 21:03
    
I was more thinking along the lines of my laptop being completely not secure. I does have a domain login password, but really running XP with no full drive encryption doesn't fill me with confidence. If someone had the need they could easily steal the laptop any documents on it, with some time (windows exploits, hardware mods). But doing so would be wrong or illegal. Picking up a USB and having a look at whats lying around doesn't seem to me as wrong. –  daniel Feb 27 '12 at 21:45
2  
If I found a random USB stick, I may look at it just to find out who lost it; if it was encrypted I would probably not bother testing further. However, for the unencrypted case, I'd be pretty paranoid about potential malware on the usb stick; so would only check from a non-production linux machine as a non-root user (and still not run any scripts/executables/document macros). –  dr jimbob Feb 27 '12 at 22:37
add comment

5 Answers 5

up vote 7 down vote accepted

This states truecrypt uses a hash-function like SHA-1 and keystrengthen it by a factor of ~2000 times. So if your attacker knew it was a four digit number; it would take your attacker under 10000 tries to crack, which means they would need about 2000×10000=20 million sha1 hashes. A GPU can generate sha1 hashes at about a billion per second; so your solution would not survive the most basic password cracking attempt.

If security of your data is a requirement, I'd recommend that instead of a four-digit number (13 bits of entropy: 213.3 ≅ 10000); using a four-word (or longer) random diceware passphrase (~52 bits: 252 ≅ (65)4 ≅ 4×1015). Instead of surviving for ~1/50th of a second, your passphrase would survive for about ~200 years of a dedicated GPU attack. This is in the realm of breakable in months by very large organizations that are very interested in getting your data (think NSA with a server farm of thousands of GPUs dedicated to cracking your encryption), but protected against all lesser brute-force threats (and adding a couple more words to the passphrase would protect against very large organizations). (EDIT: There are other methods that could be used; e.g., covert keyloggers to steal your passphrase).

As the preface to Applied Cryptography puts it:

There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files.

Your current solution prevents against the "kid sister" attacks of the world, but would not be much more difficult to upgrade to the "major government" kind if desired.

share|improve this answer
    
I think this answers the technical side of the question. I wasn't sure of the math on just how much easier it would be to brute force a short password compared to a longer one or a key file. I also like the last line as it describes what my sort of ethical question was better than my attempt. –  daniel Feb 27 '12 at 22:06
    
Ultimately the question "do you need strong security" boils down to would you care if the data was compromised (e.g., passwords to online bank accounts, servers, credit card numbers, information that could be used for identity theft, evidence of illegal/unethical activity etc). In other cases, I use little to no security. E.g., my usb drives have only non-confidential documents (harmless photos from family stuff, legally obtained ebooks/music/non-confidential source code), so I don't bother with encrypting it. –  dr jimbob Feb 27 '12 at 22:33
add comment

Formally, yes. You have identified a level of residual risk you are prepared to accept, based on a threat analysis, and have implemented controls to manage the risk down to this level.

Informally, as others have pointed out, if a control can be made very much stronger with very little cost, then you should do it anyway. Risk analysis and threat modelling are not very precise sciences.

Something like Courage8366gapor is not hugely more difficult to remember or type compared to a 4 digit PIN code, but the PIN takes under a second to brute force and the passphrase would take somewhere between 2 days and ten times the age of the Earth.

share|improve this answer
add comment

One argument against this is that you should not get into the habit (whether or not the risk tradeoff is acceptable) of choosing weak passwords. Since you're security-aware enough to use Truecrypt, it seems the marginal cost of using a decent passphrase would be just about zero.

share|improve this answer
add comment

In general, I think that having little security is worst than having no security at all.

Because when you have no security, you know that you have no security, and wouldn't trust it to store important things. When you have little security, you might ending up having to draw the line between important stuff vs. not-so-important-stuff vs. just-keep-curious-away. And if you fail to determine the exact point of that, you can "leak" information that you wouldn't want, really.

So, if you want to go secure, make sure you go secure, and choose a good password.

share|improve this answer
    
I disagree: weak security is often better in practice than none; you just have to not trust weak security with anything of value. As an analogy, any thief with proper tools can easily get into my locked car, but I lock the car doors to restrict any passerby from easily doing it as well. More importantly, in the first place I'll keep nothing worth stealing in my car like a phone/laptop/ipod (esp in plain-sight). Back to IT, sometimes I'll wrap a simple shared password on say an intranet-only internal resource (network printer) that contains nothing of value, but I don't want everyone to use. –  dr jimbob Feb 28 '12 at 16:46
1  
@drjimbob : I agree with you, if you know about security. For any person that who knows about security and how to deal with it, the more security you have, the better, and 0,5 is more than 0. I just got tired of finding people using a login password in the Windows and thinking that the computer was secure, just to show them that with a linux boot cd I could copy any file I wanted. User's fault? Maybe, but no message warns that it just provides a very weak protection. And, as I said, in general we deal with users, and users... are users. –  woliveirajr Feb 28 '12 at 18:12
add comment

My aim was to make it at least a little wrong for someone to access the documents, sort of like a padlock to keep out the honest criminals.

Firstly honest criminals are quite a rare breed and on the balance of probabilities you are more likely than not to meet the other more common variant, the dishonest variety.

Secondly it is much easier to lose a USB stick than a laptop due to its size and portability by either accidentally leaving it in a cyber cafe computer or just straight having it stolen from you.

So on the balance of probabilities again there is a high chance of your USB stick ending up in the hands of someone who is not an honest criminal than say a laptop so the security level must be higher.

As a general rule though you need to use a strong password on both your laptop and USB stick as good security is not based on whether or not your computer has been stolen yet, if its portable and you move it around, then it is more at risk than a stationary desktop computer.

share|improve this answer
    
Non technology savvy thiefs are probably not that uncommon. –  CodesInChaos Feb 27 '12 at 19:09
    
I think I butchered that old saying, locks keep out only the honest. If I found a USB key I might have a look at the contents, but if it came to trying to brute force an encrypted file I'd probably just wipe it. That is if i couldn't return the key to it's owner (Does anyone else put a .txt with their email address on USB keys? I know about the risk of attacks from people leaving infected USB sticks outside of interesting workplaces, but people still must get curious) –  daniel Feb 27 '12 at 21:58
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.